Arbor has recently sent out an email to schools notifying you of the introduction of a new sub‑processor – Philo Labs – T/A Birdie. As a result of this, we have completed a review and confirm the following:

• The introduction of this sub‑processor is a routine and low‑risk change
• All UK GDPR requirements are met, including appropriate data protection arrangements with the sub‑processor
• Where applicable, international data transfer safeguards are in place, and a Transfer Risk Assessment (TRA) has been completed
• The functionality supported by the sub‑processor is entirely optional and only used with your agreement during support interactions

DPIA Position

We have assessed this change and can confirm that:

• No update to the existing Data Protection Impact Assessment (DPIA) is required
• No new high‑risk processing has been identified
• The overall risk profile of the service remains unchanged

What this means for schools

There is no action required from schools as a result of this change.

This update does not affect:

• Your role as data controller
• The nature or scope of personal data processed
• Your existing contractual arrangements with Arbor

The additional tool is intended solely to support efficient issue resolution where visual context is helpful, and its use remains at the discretion of the school.